CVE-2026-111842: WordPress Sunshine Photo Cart plugin <= 3.7.5 - Broken Access Control vulnerability

Q: Who can exploit this issue?

The CVSS vector indicates that exploitation is network-accessible, requires no privileges, and does not require user interaction. This means an unauthenticated remote attacker may be able to exploit the affected access-control weakness.

Q: What is the security impact?

The reported impact is limited to integrity, with no stated confidentiality or availability impact. The issue is rated medium severity with a CVSS score of 5.3.

Q: Which plugin versions are affected?

Sunshine Photo Cart versions through 3.7.5 are affected. The available data does not identify a fixed version.

Published Oct 22, 2026

Updated

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5.

Affected Software

1 affected component

WP Sunshine Sunshine Photo Cart<=3.7.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/sunshine-photo-cart to a version that resolves this vulnerability.
Fixed in 3.8

Event History

Oct 22, 2026

CVE Published

via MITRE·08:46 AM

Data Sourced

via MITRE·08:46 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates that exploitation is network-accessible, requires no privileges, and does not require user interaction. This means an unauthenticated remote attacker may be able to exploit the affected access-control weakness.

What is the security impact?